Skip to content

Commit a7d1290

Browse files
chittimachittima
committed
Merge branch 'MC-43161' of https://github.com/magento-l3/magento2ce into PR-2021-20-08
2 parents f9b2c68 + e67cc96 commit a7d1290

File tree

6 files changed

+113
-4
lines changed

6 files changed

+113
-4
lines changed

‎app/code/Magento/Backend/App/Action/Plugin/Authentication.php

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,8 @@ public function __construct(
102102
}
103103

104104
/**
105+
* Ensures user is authenticated before accessing backend action controllers.
106+
*
105107
* @param \Magento\Backend\App\AbstractAction $subject
106108
* @param \Closure $proceed
107109
* @param \Magento\Framework\App\RequestInterface $request
@@ -225,10 +227,9 @@ protected function _redirectIfNeededAfterLogin(\Magento\Framework\App\RequestInt
225227

226228
// Checks, whether secret key is required for admin access or request uri is explicitly set
227229
if ($this->_url->useSecretKey()) {
228-
$requestParts = explode('/', trim($request->getRequestUri(), '/'), 3);
229-
$baseUrlPath = trim(parse_url($this->backendUrl->getBaseUrl(), PHP_URL_PATH), '/');
230-
$routeIndex = empty($baseUrlPath) ? 0 : 1;
231-
$requestUri = $this->_url->getUrl($requestParts[$routeIndex]);
230+
// The requested URL has an invalid secret key and therefore redirecting to this URL
231+
// will cause a security vulnerability.
232+
$requestUri = $this->_url->getUrl($this->_url->getStartupPageUrl());
232233
} elseif ($request) {
233234
$requestUri = $request->getRequestUri();
234235
}

‎app/code/Magento/Backend/Test/Mftf/ActionGroup/AdminAssertNoErrorMessageActionGroup.xml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<actionGroups xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/actionGroupSchema.xsd">
11+
<actionGroup name="AdminAssertNoErrorMessageActionGroup">
12+
<dontSeeElement selector="{{AdminMessagesSection.error}}" stepKey="dontSeeErrorMessage"/>
13+
</actionGroup>
14+
</actionGroups>

‎app/code/Magento/Backend/Test/Mftf/ActionGroup/AdminClickLogoutActionGroup.xml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<actionGroups xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/actionGroupSchema.xsd">
11+
<actionGroup name="AdminClickLogoutActionGroup">
12+
<grabAttributeFrom selector="{{AdminHeaderSection.signOut}}" userInput="href" stepKey="logoutUrl"/>
13+
<amOnPage url="{$logoutUrl}" stepKey="logout2"/>
14+
</actionGroup>
15+
</actionGroups>

‎app/code/Magento/Backend/Test/Mftf/ActionGroup/AdminLoginWithCustomUrlActionGroup.xml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<actionGroups xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/actionGroupSchema.xsd">
11+
<actionGroup name="AdminLoginWithCustomUrlActionGroup" extends="AdminLoginActionGroup">
12+
<annotations>
13+
<description>Login to specific backend URL.</description>
14+
</annotations>
15+
<arguments>
16+
<argument name="customUrl" type="string"/>
17+
</arguments>
18+
19+
<amOnPage url="{{customUrl}}" stepKey="navigateToAdmin"/>
20+
</actionGroup>
21+
</actionGroups>

‎app/code/Magento/Backend/Test/Mftf/Section/AdminHeaderSection.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,6 @@
1717
<element name="pageHeading" type="text" selector=".page-content .page-heading"/>
1818
<!-- Used for page not found error -->
1919
<element name="pageNotFoundTitle" type="text" selector=".page-title span"/>
20+
<element name="signOut" type="button" selector=".page-header .account-signout"/>
2021
</section>
2122
</sections>

‎app/code/Magento/Backend/Test/Mftf/Test/AdminRedirectToStartupPageAfterLoginIfSecretKeyEnabledTest.xml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<tests xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/testSchema.xsd">
11+
<test name="AdminRedirectToStartupPageAfterLoginIfSecretKeyEnabledTest">
12+
<annotations>
13+
<features value="Backend"/>
14+
<stories value="Login on the Admin Backend"/>
15+
<title value="Admin should not be redirected to the requested page after login if secret key is enabled"/>
16+
<description value="Admin should not be redirected to the requested page after login if secret key is enabled"/>
17+
<severity value="AVERAGE"/>
18+
<testCaseId value="AC-1145"/>
19+
<useCaseId value="MC-43161"/>
20+
<group value="backend"/>
21+
</annotations>
22+
<before>
23+
<!-- Add Secret Key to URLs -->
24+
<magentoCLI command="config:set admin/security/use_form_key 1" stepKey="enableUrlSecretKeys"/>
25+
<actionGroup ref="AdminLoginActionGroup" stepKey="loginAsAdmin"/>
26+
</before>
27+
<after>
28+
<magentoCLI command="config:set admin/security/use_form_key 0" stepKey="disableUrlSecretKeys"/>
29+
<actionGroup ref="AdminLogoutActionGroup" stepKey="logoutFromAdmin"/>
30+
</after>
31+
32+
<!-- Assert succesful login without any error message -->
33+
<actionGroup ref="AdminAssertNoErrorMessageActionGroup" stepKey="dontSeeErrorMessage1"/>
34+
<!-- Assert current page is dashboard -->
35+
<seeCurrentUrlMatches regex="~\/admin\/dashboard\/~" stepKey="seeCurrentUrlMatchesDashboardUrl"/>
36+
<!-- Navigate to web configuration -->
37+
<actionGroup ref="AdminNavigateMenuActionGroup" stepKey="navigateToFindPartnersAndExtensions">
38+
<argument name="menuUiId" value="magento-backend-stores"/>
39+
<argument name="submenuUiId" value="magento-config-system-config"/>
40+
</actionGroup>
41+
<actionGroup ref="AdminOpenConfigNavItemActionGroup" stepKey="navigateToWebConfig">
42+
<argument name="navItem" value="Web" />
43+
</actionGroup>
44+
<!-- Grab current URL -->
45+
<grabFromCurrentUrl stepKey="webConfigurationUrl"/>
46+
<!-- Logout -->
47+
<actionGroup ref="AdminClickLogoutActionGroup" stepKey="logout2"/>
48+
<!-- Login with directt url -->
49+
<actionGroup ref="AdminLoginWithCustomUrlActionGroup" stepKey="loginAndRedirectToRequestedPage">
50+
<argument name="customUrl" value="$webConfigurationUrl"/>
51+
</actionGroup>
52+
<!-- Assert succesful login without any error message -->
53+
<actionGroup ref="AdminAssertNoErrorMessageActionGroup" stepKey="dontSeeErrorMessage2"/>
54+
<!-- Assert current page is dashboard -->
55+
<seeCurrentUrlMatches regex="~\/admin\/dashboard\/~" stepKey="seeCurrentUrlMatchesDashboardUrl2"/>
56+
</test>
57+
</tests>

0 commit comments

Comments
 (0)